Risk is a nebulous but vital concept that has been central to commercial transactions ever since business began. Assessing the likelihood of any decision yielding benefit versus possible negative outcomes is a complex and time-consuming process. In today’s competitive environment, such is the need to ‘insure’ companies as much as possible, risk has even spawned its own job role at many large companies – the risk manager. This person or department, must assess every key business decision or partnership, and influence the decision as to whether it should be allowed to go through.
When applied to outsourcing, the risk equation can become much more difficult. The unknown quantity is the outsourcing partner – another whole company to appraise and understand as intimately as possible to make sure almost nothing can go wrong. The challenges of risk-insuring a company against outsourcing failure are all too apparent and horror stories still abound. In late January this year one of the longest-running disputes in the outsourcing industry finally came to a head after a court ordered EDS to cough up for its failings in BSkyB’s CRM project. Outsourcing executives are still getting things wrong and there is always much to be learned.
One area where outsourcers go awry is in the reason for outsourcing in the first place. The most common adage is ‘you don’t outsource a problem’ on the basis that much outsourcing is process and service-led. An outsourcer is just as likely to have the same problem with something as an in-house department. However, outsourcing can be used to transfer risk itself on the basis of reducing reliance on full-time staff and fluctuations in requirement.
Ferenc Szelényi, MD of Dell Perot Systems, argues:, “Outsourcing can be very effective in transferring risk, especially in pricing and operational risk.”
The trouble is, outsourcers frequently appear wooed by the possibilities of reducing risk, costs and other headaches while important concerns are forgotten – not least ensuring that the outsourcing provider is equipped to deliver what it claims as with the EDS example.
“However, supplier management is absolutely crucial to make it a success and some companies don’t put enough emphasis on it,” continues Szelényi.
The difficulties associated with managing outsourcing suppliers are varied but most lead back to communication difficulties. TPI, the sourcing advisory firm, identifies risks associated with contracts, transitions to suppliers, delivery of requirements, financial mismanagement, capability to carry out work and misalignment of expectations. The vast majority of problems experienced by those engaging in outsourcing seem to emerge from poor relationships between buyer and supplier.
Despite this, the industry is currently seeing a change that increases the amount of suppliers many end users are using – multisourcing. The trend towards expanding supplier rosters for increased competition and less-risky deals continues apace. This is despite research from PA Consulting last year indicating that outsourcing end-users were relatively naïve about the amount of governance time and investment multisourcing entails.
Jonathan Cooper-Bagnall, member of PA Consulting’s Management Group, explained last year: “We are seeing more and more that multisourcing is a developing trend, making integration of services all the more crucial. However, many ‘tier one’ organisations have already had to invest heavily in teams of people to fulfil the integration role, simply through lack of an early identification of the need for service integration.”
The reduction in risk associated with a single large supplier is clearly reduced through multisourcing, but it seems organisations must cough-up financially to balance governance risks at the other end.
James Cockroft, managing consultant for Xantus Consulting, says, “Multiple outsourcing contracts can cause problems as they are often negotiated at different times through different in-house teams, even when using the same outsourced contractor.
“This leads to ambiguities and can require more mediation. It can be like marriage counselling between different suppliers. This increases the size and nature of internal resource required to manage outsourced contracts.”
However, it appears the costs associated with this extra management resource may be beneficial to the overall sourcing equation. As end-users become more advanced at managing outsourcing, the risks associated with surrendering control to suppliers reduce.
Ferenc Szelényi, MD of Dell Perot Systems, explains: “Over the past few years, in a bid to minimize risk for the customer, the trend has been towards IT outsourcing deals that are smaller in size and shorter in duration.
“Outsourcing has become mainstream and clients are more educated and sophisticated than ever before. They are, therefore, more comfortable managing multiple contracts with multiple vendors which also minimizes risk.”
Aside from simply investing in management across outsourcing deals, there are numerous other areas that end-users can also address to minimise risk in working with outsourcers.
“Outsourced suppliers do a lot of things well, but what they are not so good at should also be recognised. Strategy, commercial management, governance and contract management remain best suited to in-house departments. After all, a company will always know its business better than anyone else, regardless of how embedded outsourced suppliers are,” comments Cockroft.
At the centre of almost all industry best-practice advice is a water-tight and coherent contract. Ensuring that all agreements, SLAs, KPIs and other metrics are appropriately enshrined in a clear legal document has become an important step in all outsourcing deals. Nowadays, most good suppliers will be as ardent about creating a clear contract as the end-user. Experience has taught the industry the importance of a good legal agreement and the contract usually provides key to ensuring everyone knows exactly what is going on.
Phil Riman, partner at technology and corporate law firm, White & Black Legal, comments: "Relations between a company and its supplier often deteriorate for perfectly avoidable, but all too common, reasons.
“These include the existence of unrealistic and inadequate transitional arrangements; poorly constructed service levels and flawed pricing structures which do not reflect trading realities.”
To ensure risk is reduced and chances of success, increased, industry experts advise a clear contract and in-depth due-diligence before any agreement is put in place. Systematic assessment of suppliers, and locations if offshoring, should uncover and possible future issues.
Iain Monaghan, partner at international law firm Pinsent Masons, adds: " Whatever the contract might say, it will be difficult for a regulated company to claim that it should take no responsibility for a major security breach if a cursory examination of its supplier's security arrangements would have shown they were inadequate.
When offshoring enters the mix, the traditional risk equation can change significantly. Though sourcingfocus.com’s investigation last year found minimal impact on outsourcing operations from occurrences like Mumbai’s attacks and Sri Lanka’s war, some countries simply never make the list of possibilities locations. Those that do are subject to further scrutiny in areas including data protection and cultural alignment.
Cockroft, believes, “Cultures and behaviours need to be carefully managed. In some cultures there is an automatic assumption by outsourced suppliers that the client is always right. Sometimes they will say “yes” publically, even when privately they know they are unable to deliver.”
The onus is firmly on extensive supplier due-diligence whenever a company looks beyond its own shores. An end-user needs to be sure it can work effectively and efficiently with its chosen partner. However, those considering offshoring would also do well to examine the local macro-economic, legal and political environment to mitigate against further risks. Ferenc Szelényi explains that end-user should also look at governmental access to service providers as well as over the customer’s data.
“Promising locations like South Africa, Columbia, Malaysia, Thailand and Mexico have done little in terms of Government initiatives or social change to allay client fears about their safety as an outsourcing destination. Some countries with more established IT export businesses, like the Philippines and Brazil, have been slow to progress.”
While it is clear that risk can never be entirely removed from outsourcing, there are certainly many areas a careful end-user can address to reduce it significantly. At the centre of everything says Szelényi, is starting early and ensuring all risks are assessed and understood from the start: “An organisation’s security staff should be at the table from the start of the process and throughout the lifecycle of the outsourcing deal.
“The security staff should be included in the operation’s management functions, working with the vendor’s delivery management staff, as well as the strategic planning functions where standards, architecture and integration decisions are made,” he concludes.
Only by investing intelligently in supplier-assessment and management, it seems, can end-users truly sway the outsourcing risk-reward equation firmly in their favour.